Browsing logs
When you open the Logs section, you see a list of recent log entries across your connected assets, displayed in reverse chronological order. Each row in the log viewer shows a summary of the event — timestamp, IP address, HTTP method, path, status code, and country — along with a severity indicator for WAF events. You can expand any row to see the full event fields for that log entry. The log viewer uses virtual scrolling, so large result sets load smoothly without freezing the browser.Filtering logs
Use the filter controls at the top of the log viewer to narrow the results:
You can apply multiple filters at the same time. The log viewer reloads automatically when you change a filter.
Cursor-based pagination
The log viewer uses cursor-based pagination to handle large datasets efficiently. As you scroll to the bottom of the result list, the next page of results loads automatically. This approach keeps performance consistent regardless of how many log events exist in the selected time range. There is no “page 5” or “jump to offset” — results always load forward from your current position. If you need to find a specific event far back in time, use the time range filter to jump to that window directly.Log fields
HTTP logs and WAF logs contain different fields. Use the tabs below to see what is available in each dataset.- HTTP logs
- WAF logs
HTTP logs capture every request processed by Cloudflare for your connected assets.
Exporting logs
You can export a filtered set of logs to a downloadable file. Flarehawk generates the export in the background and provides a signed download link when it is ready.1
Open the export dialog
In the log viewer, select the Download button in the toolbar. The log export dialog opens.
2
Choose a time range
Select a preset time range or enter a custom start and end date and time. The available presets are: 1 hour, 6 hours, 24 hours, 7 days, 30 days, 90 days, 1 year, and 5 years.
3
Apply filters (optional)
You can scope the export to a specific dataset (HTTP, WAF, or both), a specific asset, and other filters carried over from the log viewer. Narrower exports process faster and produce smaller files.
4
Request the export
Select Export to submit the export job. Flarehawk begins preparing your file in the background.
5
Download the file
When the export is ready, a signed download link appears in the dialog. The link is valid for a limited time. Select it to download the file to your device.
Event retention by plan
How far back you can query and export logs depends on your Flarehawk plan:Event retention refers to the period during which raw log events are queryable in the dashboard and exportable. Alert retention is separate — alerts are retained for 90 days regardless of plan.
Using logs to investigate an alert
When you receive an alert, the log viewer is one of the most effective tools for confirming what happened and understanding the scope. Here is a suggested investigation flow:1
Open the alert detail
In the Incidents section, open the alert. Note the timestamp, the affected asset, the source IP (if shown in evidence), and the affected paths listed in the evidence.
2
Set the time range in the log viewer
Switch to the Logs section. Set the time range to start a few minutes before the alert fired and end a few minutes after. This gives you context before and after the detection point.
3
Filter by IP or path
If the alert evidence includes a suspicious IP address, enter it in the IP filter. If the alert references specific paths, filter by path. This narrows the log list to the most relevant entries.
4
Switch to WAF logs if needed
If the alert was triggered by a WAF rule, switch the dataset filter to WAF logs. Look for the rule ID from the alert evidence to find the exact matching events.
5
Export for deeper analysis
If the scope is larger than what you can review in the log viewer, export the filtered result set for offline analysis in a tool of your choice.